CISA Updates OSS Guidance; Ransomware Groups Active; Critical Vulnerabilities Patched

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has released further details on its open source software security guidance. Key additions include the introduction of the 'C4 Framework' (Community, Code, Contribution, and Continuity) to help agencies assess the trustworthiness and risk profile of OSS projects. Furthermore, CISA now encourages federal agencies to adopt a 'default open source' approach for their custom-developed software, fostering collaboration and community contributions. The update also clarifies that AI systems should only be considered open source for risk management if their training data and models are fully transparent.

New intelligence from U.S. officials now attributes the ongoing cyberattacks against the Water and Wastewater Systems (WWS) sector to actors linked to Iran, specifically mentioning groups like CyberAv3ngers. The FBI and EPA are investigating the widespread campaign, which continues to target internet-exposed Rockwell Automation PLCs in at least seven states, including newly identified Minnesota and Michigan. The attacks cause operational disruptions such as loss of water pressure and force utilities into manual operations. This attribution elevates the threat, highlighting potential state-sponsored involvement in critical infrastructure targeting.

Microsoft has definitively attributed the 'CaptiveCrunch' campaign to Midnight Blizzard (APT29/Cozy Bear), a Russian SVR-linked threat actor, clarifying that Storm-2945 is a sub-cluster. The campaign now involves a second sophisticated infostealer, ChocoShell, which operates in-memory via PowerShell, steals M365/Azure AD tokens, bypasses Chrome's App-Bound Encryption, and disables Windows Defender updates. The CornFlake RAT's persistence mechanism ('Cloud Sync Service') and additional capabilities (screenshots, clipboard capture) are also detailed. Attackers use Adversary-in-the-Middle (AitM) techniques by manipulating DNS and HTTP on compromised hotel Wi-Fi networks, delivering payloads via a C2 panel named FruitStone. This update significantly increases the understanding of the threat actor's capabilities and the campaign's sophistication.